From 3e572b41fa1ceeac4c8ef2c6c5fd0ed9de58bfa3 Mon Sep 17 00:00:00 2001 From: Sachin Hulyalkar Date: Mon, 27 Jul 2026 10:52:55 +0000 Subject: [PATCH] chore: override tar to ^7.5.19, brace-expansion to ^5.0.8 --- LICENSE-THIRD-PARTY | 2 +- .../oss-attribution-generator/package-lock.json | 8 ++++---- .../oss-attribution-generator/package.json | 4 ++-- overrides/LICENSE-THIRD-PARTY | 2 +- .../sagemaker.series/package-lock.json | 8 ++++---- .../package-lock.json | 8 ++++---- .../web-embedded.series/package-lock.json | 8 ++++---- .../web-server.series/package-lock.json | 8 ++++---- patches/common/finding-override-tar.diff | 10 +++++----- 9 files changed, 29 insertions(+), 29 deletions(-) diff --git a/LICENSE-THIRD-PARTY b/LICENSE-THIRD-PARTY index f56861b5..dc76f1b7 100644 --- a/LICENSE-THIRD-PARTY +++ b/LICENSE-THIRD-PARTY @@ -6547,7 +6547,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ****************************** tar -7.5.16 +7.5.22 # Blue Oak Model License Version 1.0.0 diff --git a/build-tools/oss-attribution/oss-attribution-generator/package-lock.json b/build-tools/oss-attribution/oss-attribution-generator/package-lock.json index a21bef05..d24d176f 100644 --- a/build-tools/oss-attribution/oss-attribution-generator/package-lock.json +++ b/build-tools/oss-attribution/oss-attribution-generator/package-lock.json @@ -85,15 +85,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/chalk": { diff --git a/build-tools/oss-attribution/oss-attribution-generator/package.json b/build-tools/oss-attribution/oss-attribution-generator/package.json index aefa6a0e..4946a19a 100644 --- a/build-tools/oss-attribution/oss-attribution-generator/package.json +++ b/build-tools/oss-attribution/oss-attribution-generator/package.json @@ -4,6 +4,6 @@ }, "overrides": { "minimatch": "^10.2.3", - "brace-expansion": "^5.0.6" + "brace-expansion": "^5.0.8" } -} \ No newline at end of file +} diff --git a/overrides/LICENSE-THIRD-PARTY b/overrides/LICENSE-THIRD-PARTY index f56861b5..dc76f1b7 100644 --- a/overrides/LICENSE-THIRD-PARTY +++ b/overrides/LICENSE-THIRD-PARTY @@ -6547,7 +6547,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ****************************** tar -7.5.16 +7.5.22 # Blue Oak Model License Version 1.0.0 diff --git a/package-lock-overrides/sagemaker.series/package-lock.json b/package-lock-overrides/sagemaker.series/package-lock.json index 39d98f51..87c4fbd7 100644 --- a/package-lock-overrides/sagemaker.series/package-lock.json +++ b/package-lock-overrides/sagemaker.series/package-lock.json @@ -148,7 +148,7 @@ "source-map": "0.6.1", "source-map-support": "^0.3.2", "style-loader": "^3.3.2", - "tar": "^7.5.16", + "tar": "^7.5.19", "ts-loader": "^9.5.1", "ts-node": "^10.9.1", "tsec": "0.2.7", @@ -15276,9 +15276,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json b/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json index e832becd..9f1a9f0e 100644 --- a/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json +++ b/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json @@ -146,7 +146,7 @@ "source-map": "0.6.1", "source-map-support": "^0.3.2", "style-loader": "^3.3.2", - "tar": "^7.5.16", + "tar": "^7.5.19", "ts-loader": "^9.5.1", "ts-node": "^10.9.1", "tsec": "0.2.7", @@ -15242,9 +15242,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/package-lock-overrides/web-embedded.series/package-lock.json b/package-lock-overrides/web-embedded.series/package-lock.json index e832becd..9f1a9f0e 100644 --- a/package-lock-overrides/web-embedded.series/package-lock.json +++ b/package-lock-overrides/web-embedded.series/package-lock.json @@ -146,7 +146,7 @@ "source-map": "0.6.1", "source-map-support": "^0.3.2", "style-loader": "^3.3.2", - "tar": "^7.5.16", + "tar": "^7.5.19", "ts-loader": "^9.5.1", "ts-node": "^10.9.1", "tsec": "0.2.7", @@ -15242,9 +15242,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/package-lock-overrides/web-server.series/package-lock.json b/package-lock-overrides/web-server.series/package-lock.json index 90accd84..5da9905c 100644 --- a/package-lock-overrides/web-server.series/package-lock.json +++ b/package-lock-overrides/web-server.series/package-lock.json @@ -148,7 +148,7 @@ "source-map": "0.6.1", "source-map-support": "^0.3.2", "style-loader": "^3.3.2", - "tar": "^7.5.16", + "tar": "^7.5.19", "ts-loader": "^9.5.1", "ts-node": "^10.9.1", "tsec": "0.2.7", @@ -15293,9 +15293,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", diff --git a/patches/common/finding-override-tar.diff b/patches/common/finding-override-tar.diff index e9ea9187..b7110cd1 100644 --- a/patches/common/finding-override-tar.diff +++ b/patches/common/finding-override-tar.diff @@ -1,8 +1,8 @@ -Override tar to ^7.5.16 to fix CVE-2026-53655. +Override tar to ^7.5.19. @generated -@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct-dev:tar=^7.5.16' --override 'global:tar=^7.5.16' -@override-package: tar@^7.5.16 +@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct-dev:tar=^7.5.19' --override 'global:tar=^7.5.19' +@override-package: tar@^7.5.19 Index: b/package.json =================================================================== @@ -13,7 +13,7 @@ Index: b/package.json "source-map-support": "^0.3.2", "style-loader": "^3.3.2", - "tar": "^7.5.10", -+ "tar": "^7.5.16", ++ "tar": "^7.5.19", "ts-loader": "^9.5.1", "ts-node": "^10.9.1", "tsec": "0.2.7", @@ -23,7 +23,7 @@ Index: b/package.json "undici": "^7.28.0", - "ws": "^7.5.11" + "ws": "^7.5.11", -+ "tar": "^7.5.16" ++ "tar": "^7.5.19" }, "repository": { "type": "git",